Aurora global cluster has no demonstrated customer-managed key choice

What it checks

Aurora global cluster: customer-managed key control is not demonstrated by the source regional cluster.

Where it applies

Terraform: aws_rds_global_cluster

CloudFormation: AWS::RDS::GlobalCluster

How to fix it

1. Inspect the source regional cluster's encryption type and KMS key. If customer key control is required, plan a supported encrypted source and global-database migration; verify all regional members before cutover.

Frameworks

• SOC 2 CC6.1
• HIPAA 164.312(a)(2)(iv)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules